Windows 11 November 2026 Patch Tuesday: PowerShell Signing Changes and NTLM Hardening

What shipped, and for whom​

Windows Report says Microsoft released three packages this month:

The Microsoft Update Catalog lists "2026-11 Cumulative Update for Windows 11, version 26H2 for x64-based Systems (KB5132061) (26300.9974)". That confirms the 26H2 build number. The Russian site Comss.ru separately lists KB5132061 builds for 24H2, 25H2 and 26H2, and says each comes in x64 (amd64) and ARM64 versions. Comss.ru also says the 24H2 package covers Windows 11 version 24H2 and Windows 11 LTSC 2024, which matters for anyone running long-term servicing machines. The search results used here did not separately confirm the 23H2 and 26H1 build numbers, so those come from Windows Report.

Each version gets its own release because of the build families. 24H2, 25H2 and 26H2 are all on the shared 26100-series platform, so one KB number serves all three. 23H2 is on the older 22631 base, and 26H1 is on the separate 28000 platform, so each gets its own package.

Lifecycle notes you might miss​

• For 23H2, this is the final update. Microsoft's Windows message center says Windows 11 version 23H2 Enterprise and Education editions reached end of updates on November 10, 2026. The November security update is the last one those editions will get, and Microsoft recommends moving eligible devices to 26H2. Wikipedia's Windows 11 lifecycle table gives the same date, listing 23H2 servicing ending November 10, 2026. In practice, KB5131087 is the last patch for those machines.
• 24H2 Home and Pro are already out of support. Comss.ru says Microsoft ended support for consumer editions of Windows 11 version 24H2 (Home and Pro) on October 13, 2026. KB5132061 still ships to 24H2 because Enterprise, Education and LTSC 2024 remain supported.
• 26H1 is ARM-only. Wikipedia's version table lists 26H1 (build 28000) as ARM only, so KB5132059 only applies to that hardware.

Summary: One KB covers the three current 26100-family releases. The two separate packages go to 23H2 (its last update) and 26H1 on ARM.

The changelog, translated for people who have to support it​

According to Windows Report, all three packages carry the same changelog.

Security fixes and NTLM signing​

Besides the usual unspecified vulnerability fixes, the main security change is in NTLM. Clients will now offer NTLM message signing by default on non-anonymous connections, and Windows adds auditing to show which connections don't use signing. Microsoft's stated aim is to reduce exposure to NTLM relay attacks.

This was signalled in advance and is part of a larger effort. In October, Microsoft's message center said the October 2026 security update began blocking NTLMv1-derived credentials for single sign-on by default on 24H2, 25H2, 26H2 and Windows Server 2025, on devices with Credential Guard turned off. The message center warned that Wi-Fi, Ethernet and VPN connections using MS-CHAPv2 could be affected, and described the change as part of Microsoft's effort to phase out NTLM. The November signing default is the next step.

The audit trail is the useful part for admins. It shows which connections in your network still don't use signing. Our view, based on general industry experience: treat those audit results as your migration list for moving off NTLM, not just as compliance paperwork.

Secure Boot certificates: a wider rollout​

The update adds more "high confidence" device-targeting data, which increases the number of PCs that can receive new Secure Boot certificates automatically. Deployment through Windows Update will continue across supported PCs and non-managed business devices over the coming months.

Microsoft's message center has also been warning that some consumer and business devices may need one extra restart during installation. That restart happens after a Secure Boot certificate update is applied. If a machine reboots twice this month, that's probably why, not a fault.

Fixes for earlier updates​

• USB Audio 1.0 devices: Fixed a problem where these devices could fail to start and show Code 10 in Device Manager after a recent security update. Windows Report lists it as a known issue. Microsoft's message center separately says September's out-of-band update addressed USB Audio Class 1.0 devices failing in multichannel modes, so audio over this older USB class has had a rough few months.
• Adding Active Directory printers: Fixed error 87, "The parameter is incorrect," when adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device. The October 2026 update caused it. It affected adding printers, not existing printers or normal printing.
• Remote Desktop: Fixed client-side RDP connection failures caused by a certificate mismatch after the October 2026 non-security preview update. That means only machines that installed the optional October preview should have been hit.

Cuba's time zone​

The update changes daylight saving time rules for Cuba. The country stays on UTC−04:00 and skips both the November 2026 and March 2027 clock changes. It returns to UTC−05:00 in November 2027 and goes back to its normal seasonal schedule in 2028.

Microsoft's message center explains the timing. Cuba announced on October 27 that it would stay on daylight saving time instead of turning clocks back on November 1. Until the fix was installed, devices set to "(UTC-05:00) Havana" could show the wrong local time. Microsoft had published interim workaround guidance and said the fix was planned for this November release. If you have users or servers set to Havana time, installing this update fixes the clock.

Summary: NTLM hardening and the Secure Boot rollout are the main security changes. The printer, audio and RDP fixes clean up problems from October's updates.

The PowerShell change admins need to know about​

This change will catch some IT teams off guard. The update makes PowerShell script signing and signature verification stricter about encoding. Scripts that contain invalid UTF-8 may now fail signature validation, even if they passed before. The fix, per the changelog, is to find the affected scripts, re-save them as valid UTF-8 with a byte order mark (BOM), and sign them again.

Microsoft's PowerShell documentation explains why this happens. Script signing depends on the file's encoding, so changing a signed script's encoding means re-signing it. The defaults also differ between versions. In PowerShell 6 and later the default is UTF-8 without a BOM. In Windows PowerShell it's usually Windows-1252. VS Code saves as UTF-8 without a BOM unless you change it. The docs list the usual causes: another editor overwriting a file in a different encoding (the ISE is a known offender), source control checking files in with a different encoding, and copying script text from email, web pages or Word documents.

A practical checklist​

1. Find scripts that now fail. Look for signed scripts that stop passing validation after installing the update, especially anything with em-dashes, curly quotes, non-breaking spaces or accented characters. Those characters are the most likely to have been mangled.
2. Re-save as UTF-8 with BOM. In VS Code, click the encoding label in the status bar and choose Save with encoding. To make it the default for PowerShell files, Microsoft's docs suggest setting "files.encoding": "utf8bom" in a [powershell] language-specific block.
3. Sign again. Changing the encoding breaks the old signature. That's expected.
4. Fix the pipeline. If your build or source-control process re-encodes files, the problem will come back. Configure those tools to use the same encoding as your editor.

Hotpatch users have one more item. Microsoft's message center says separate standalone security updates are available this month for hotpatch-enrolled devices. They address Windows PowerShell vulnerabilities involving web requests, PowerShell workflows and the Desired State Configuration Archive Resource. On 26H2, 25H2 and 24H2 the package is KB5135385. It's offered after the November hotpatch is installed and may need a restart.

Summary: The fix for the script-signing change is simple, but only if you know about it before your automation starts failing.

How to get the updates​

On personal and unmanaged PCs, go to Settings > Windows Update, select Check for updates, then Download and install if the update is offered. Managed environments will get the packages through their usual channels: Windows Update for Business, WSUS or the Microsoft Update Catalog. Comss.ru notes that KB5132061 is delivered in "checkpoint" format, so manual installs may need the prerequisite checkpoint package as well.

The bottom line​

This is a typical Patch Tuesday, which is fine. Apply it promptly, especially on 23H2 Enterprise and Education machines, since this is their last update. Before you roll it out widely, test the two changes most likely to break something: NTLM signing (watch the audit events) and PowerShell signature validation (check your signed scripts).